Baitaphish
Security intelligence
SearchLatest briefing
tutorial · bandit

Bandit Level 29 → 30

Inspect remote branches rather than trusting the default checkout.

By

Bandit
banditgitbranches
Marks this level complete in your browser.

Goal

Clone the bandit29-git repository and find the password on a non-default branch.

Why this matters

A default branch is only one view of repository state; security review must account for all reachable refs.

Progressive hints

  1. Hint 1

    List local and remote branches.

  2. Hint 2

    Inspect remote branch names before checking one out.

  3. Hint 3

    Read the changed README on the relevant branch.

Method

Run only the lines that match the evidence you observe.

git clone <official-bandit29-repository-url>
cd repo && git branch --all
git switch <branch-name>
cat README

Expected non-secret observation

A non-default branch contains the credential absent from the initial checkout.

Explanation

Clone fetches remote refs, while the working tree initially reflects only the default branch.

Troubleshooting

  • Use git branch -r if remote names are hidden in a long listing.
  • Modern Git can switch directly to a uniquely named remote-tracking branch.

Safety and cleanup

  • Use only the OverTheWire game host and your own local practice directory.
  • Do not paste a level password into this site, screenshots, notes, or submissions. Baitaphish never asks for credentials.
  • Treat commands as learning prompts: inspect paths and flags before running them.

Completion and next step

Use the recovered credential only in the official Level 30 login. Then mark this transition complete and continue.

← Bandit Level 28 → 29Bandit Level 30 → 31 →